matrix-org / matrix-org/matrix-spec
Unexpected powerlevels interactions
- Dominant language
- HTML
- Stars
- 330
- Forks
- 150
- Avg merge
- 2h 21m
- Merged PRs (30d)
- 3
Description
We accept some PL event transitions that are maybe unexpected.
Suppose we have a room where:
* `events."m.room.power_levels"` has been lowered to 50 (ie, "moderators" have been allowed to change the power levels)
* `users."@mischievous_mod:example.com"` is 50 (ie, they are a moderator)
* `events_default` is 75, so `@mischievous_mod` (and other users) cannot send arbitrary events.
Now:
1. `@mischievous_mod` can add new entries to `events`, thus allowing themselves (or other users) to send events. This appears to be counter to the spirit of point 10.4.1 of the [auth rules](https://spec.matrix.org/v1.4/rooms/v1/#authorization-rules):
> For each entry being added ... in both the events and users keys: if the current value is higher than the `sender`’s current power level, reject.
... which seems to seek to prevent the sender of a PL event from controlling the transmission of events that they themselves do not have permission to send.
2. Conversely, suppose there is an existing entry in `events` setting `"m.room.message": 0`. The mischievous moderator can *remove* this entry, thus changing the required PL for sending such an event to the default (75). This appears to be counter to the spirit of point 10.4.2:
> If the new value is higher than the `sender`’s current power level, reject.
... which seems to seek to prevent the sender of a PL event from preventing other users with the same PL from sending that event.
Suppose now that `users_default` is 75.
3. `@mischievous_mod` can add an entry to the `users` key *demoting* another user with a higher power level than themselves.
4. `@mischievous_mod` can *remove* an entry from the `users` key, *promoting* another user (or themselves) to a higher power level than their own.
Contributor guide
Research direction
Start with the authorization rules section linked in the issue and compare its wording with the four power-level transitions described here. Determine whether these behaviors are intended or require a specification change; done requires a decided interpretation and an agreed update to the Matrix specification.
Written by the indexing model from the issue text.
Assessment
- Domain
- authorization, security
- Issue type
- Bug
- Difficulty
- 5/5
- Estimated time
- Over a week
- Activity status
- Stale
- Clarity
- Needs clarification
- Newbie friendliness
- 25/100